4 ms·

I mostly agree that curl to shell isn't terrible, but he misses the big negative security implication: the shell scripts are unsigned. It is almost always far,

by OskarS 7y ago

I mostly agree that curl to shell isn't terrible, but he misses the big negative security implication: the shell scripts are unsigned. It is almost always far, far easier to hack into somebodies website and replace replace "good shell script" with "evil shell script" (or hack into someones GitHub account and make a commit evilifying a shell script) than it is to both do that and get a hold of the developers private key and sign the script. The signing key is usually far more protected and non-public than the web server is. So no, I'm probably not going to review the entire install script either way, but I'm FAR more comfortable running an install script I found online that has been signed by a developer I trust rather than one that hasn't. Package managers and OS installers handle this for you and freak out if there's any issues. In other words, the question with package managers/installers is "Do I trust this developer?". The question with curl-to-sh is "Do I trust this developer AND do I trust that the website hasn't been compromised".

falcolas 7y ago
> "Do I trust this developer AND do I trust that the website hasn't been compromised". You also have to verify that the script is coming encrypted over TLS. It's not mandatory, and there's no warnings if its not. Sure, it's an easy check (barring redirects, which also occur), but how many people who are copy/pasting curl|sh scripts will think to do even that basic validation?
- acdha 7y ago
  Your mistake is assuming that people only do that for curl|sh — in my experience, the same percentage (high) will manually download and run a program / shell script, add an APT/YUM repository, etc. Once someone decides they need to run something the details aren’t very significant. The problem isn’t curl but the challenge of trusting code. The default needs to be either Apple-style sandboxing (note how you get prompted if a new program tries to access your pictures, contacts, etc.) or something like Docker where the default is private with exceptions for the resources you enable.
  - falcolas 7y ago
    Package managers at least provide a path to trust - the PGP web of trust. curl|sh does not provide any path to (cryptographically secured) trust.
    - acdha 7y ago
      That's only for people using the global trust mechanism in a mainstream repo. If you think about it from a security perspective, how much difference does installing some random project's GPG signing key make?
- OskarS 7y ago
  Yes, very true, I was sort of assuming that the Hacker News folks would know to check for "https" and that any person offering a curl|sh solution would be sane enough not to offer it over http. But yeah, it's a good point that it's easy enough to miss.
Carpetsmoker 7y ago
I wanted to update the article to adress signing in more detail last time this was shared, but ... I'm lazy :-) I does mention it though: "Package managers are more secure due to checksums, signing, and auditing". Maintaining packages is a lot of work: there are many of them, all with different policies/update schedules/etc. It can be very time-consuming to maintain a package for all systems. Package managers are great, but does come with some trade-offs, like most things. There is nothing really stopping you from signing shell scripts; although I'm not sure if you'll still be able to run them with some clever "curl | gpg | sh" pipeline; but you can "curl>file; gpg [..]; sh file" it. I think very few people actually verify signatures manually anyway, not in the least because it's kinda hard to do so (gpg is a beast, although there are some better alternatives now, such as signify/minisign).

by OskarS 7y ago

falcolas 7y ago

> "Do I trust this developer AND do I trust that the website hasn't been compromised". You also have to verify that the script is coming encrypted over TLS. It's not mandatory, and there's no warnings if its not. Sure, it's an easy check (barring redirects, which also occur), but how many people who are copy/pasting curl|sh scripts will think to do even that basic validation?

acdha 7y ago
Your mistake is assuming that people only do that for curl|sh — in my experience, the same percentage (high) will manually download and run a program / shell script, add an APT/YUM repository, etc. Once someone decides they need to run something the details aren’t very significant. The problem isn’t curl but the challenge of trusting code. The default needs to be either Apple-style sandboxing (note how you get prompted if a new program tries to access your pictures, contacts, etc.) or something like Docker where the default is private with exceptions for the resources you enable.
- falcolas 7y ago
  Package managers at least provide a path to trust - the PGP web of trust. curl|sh does not provide any path to (cryptographically secured) trust.
  - acdha 7y ago
    That's only for people using the global trust mechanism in a mainstream repo. If you think about it from a security perspective, how much difference does installing some random project's GPG signing key make?
OskarS 7y ago
Yes, very true, I was sort of assuming that the Hacker News folks would know to check for "https" and that any person offering a curl|sh solution would be sane enough not to offer it over http. But yeah, it's a good point that it's easy enough to miss.

Carpetsmoker 7y ago

I wanted to update the article to adress signing in more detail last time this was shared, but ... I'm lazy :-) I does mention it though: "Package managers are more secure due to checksums, signing, and auditing". Maintaining packages is a lot of work: there are many of them, all with different policies/update schedules/etc. It can be very time-consuming to maintain a package for all systems. Package managers are great, but does come with some trade-offs, like most things. There is nothing really stopping you from signing shell scripts; although I'm not sure if you'll still be able to run them with some clever "curl | gpg | sh" pipeline; but you can "curl>file; gpg [..]; sh file" it. I think very few people actually verify signatures manually anyway, not in the least because it's kinda hard to do so (gpg is a beast, although there are some better alternatives now, such as signify/minisign).